BIOS Could Hide Rootkits

Attackers armed with rootkits may hide some of their malicious code inside the PC's BIOS flash memory, a researcher said at this week's Black Hat conference, a tactic that would make it tougher for defenses to detect the cloaking, and infecting the computer permanently, even if the operating system's reinstalled.

John Heasman, principal security consultant for U.K.-based Next-Generation Security Software (NGS), laid out the threat in a presentation Wednesday at the Black Hat conference in Washington, D.C.

Attackers could use the Advanced Configuration and Power Interface (ACPI), a collection of power management controls, and its programming language to code and/or deploy snippets of a rootkit into the BIOS flash memory. Hackers could even replace legitimate functions in the ACPI's language with their own, malicious, operations, said Heasman.

Among the dangers of such BIOS rootkits, he added, were that they were immune to reboots -- eliminating the current practice of hackers re-running the code each time the machine starts up, one way security software sniffs out malicious code -- weren't detectable on the drive (which current security software spends most of its time examining), and could survive disk reformatting and operating system reinstallation.

To defend systems against such strategies, Heasman said systems could be set to prevent BIOS memory reflashing (usually done by resetting a jumped on the motherboard) or shifting to computers with use signed BIOS, such as Phoenix Technologies' TrustedCore or Intel's SecureFlash.